Medium severity5.0OSV Advisory· Published Nov 28, 2025· Updated Apr 15, 2026
CVE-2025-66371
CVE-2025-66371
Description
Peppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration. When validating XML-based invoices, the XML parser could read files from the filesystem and expose their content to a remote host.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
peppol_pyPyPI | < 1.1.1 | 1.1.1 |
Affected products
2Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-24hm-wm2h-h8w7ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-66371ghsaADVISORY
- github.com/iterasdev/peppol-py/commit/349a4bff8adb6205ea411bac8d7a06da0477abd7nvdWEB
- github.com/iterasdev/peppol-py/pull/16nvdWEB
- github.com/iterasdev/peppol-py/releases/tag/1.1.1nvdWEB
- invoice.secvuln.infonvdWEB
News mentions
0No linked articles in our index yet.